Information Management Assessment

Action plan progress review

Department for International Development (DFID)

Reviewed March 2018

Published July 2018

Working with government to raise standards in information management Contents

Background 3 Action plan development 3 Summary of progress since the IMA 4 Next steps 7

© Crown copyright 2018.

You may use and re-use the information featured in this report (not including logos) free of charge in any format or medium, under the terms of the Open Government Licence v3.0.

Any enquiries regarding the use and re-use of this information resource should be sent to psi@nationalarchives.gsi.gov.uk Background

The Information Management Assessment (IMA) programme is the best-practice model for government bodies wishing to demonstrate commitment to the principles of good information management.

The Department for International Development (DFID) IMA took place in November 2016. This progress review summarises key developments since the IMA. Areas where continued attention is still needed are listed below under ‘Next Steps.’

Action plan development

DFID promptly produced a detailed action plan following the IMA. Although progress against the IMA action plan was not formally reported at board level throughout the process, it was discussed at a meeting on the IMA between The National Archives Chief Executive Officer and the DFID Permanent Secretary in November 2017.

The National Archives formally assessed progress against the action plan in March 2018.

We recommend that DFID reports on work achieved since the IMA and on remaining areas of risk to its audit and risk committee. The IMA report and updated action plan are both published on The National Archives’ website.¹

¹ [http://www.nationalarchives.gov.uk/information-management/manage-information/ima/ima-reports-action-plans/](http://www.nationalarchives.gov.uk/information-management/manage-information/ima/ima-reports-action-plans/) Summary of progress since the IMA

1 The value of information

| Performance rating | IMA 2016 | Review 2018 | |-------------------------------------|-------------------|------------------------------| | Communicating and realising value | Good practice | Good practice | | Managing information as an asset | Development needed| Progressing towards satisfactory |

- The Department for International Development (DFID) has updated its information strategy to reflect changes in the technology landscape. The strategy has been signed off by the Chief Information Officer and it has been published internally. It is aligned with the DFID technology and digital strategies and with DFID’s data roadmap. See next steps

- The Director General Finance and Corporate Performance has been assigned the role of senior champion for Knowledge and Information Management (KIM) and DFID is considering how it might establish a network of senior champions across the business. See next steps

- DFID is working to improve its approach to managing its information assets. This includes factoring in disposal requirements. It is exploring how to make the Information Asset Owner (IAO) role more effective and has incorporated policy and guidance on the IAO role in its new Corporate Control and Assurance Rules framework. DFID is also assessing how it can increase the usefulness of its Information Asset Register as a tool to manage information risks. It has engaged with work conducted by the Government KIM profession on Information Asset Registers and guidance for IAOs. See next steps

2 Digital information and supporting technology

| Performance rating | IMA 2016 | Review 2018 | |-------------------------------------|-------------------|------------------------------| | Supporting information through technology | Good practice | Good practice | | Digital continuity and IT change | Satisfactory | Satisfactory |

- The KIM team and technology colleagues continue to work closely on the rollout of Office 365, ensuring that information and records management considerations are taken into account including retention and what tools can be used for. DFID has, for example, applied 1GB limits to One Drive to help discourage staff from saving large amounts of information there. See next steps • DFID is currently testing a new joined-up search tool with staff. This currently covers the Staff Directory, the Aid Management Platform and published documents in Vault and DFID aims to extend its scope.

• Reviews are being undertaken to identify and rationalise information repositories outside Vault, including team sites and shared drives. See next steps

3 Information risk, governance and oversight

| Performance rating | IMA 2016 | Review 2018 | |-------------------------------------|-------------------|----------------------------------| | Recognising information risk | Development needed| Progressing towards satisfactory | | Establishing control | Development needed| Progressing towards satisfactory | | Providing guidance | Satisfactory | Satisfactory | | Measuring impact | Development needed| Progressing towards satisfactory |

• DFID has greater understanding and oversight of the information and records management risks it faces. It is intended that DFID’s new knowledge and information focussed Steering Group (see below) will escalate a summary risk based on the information strategy for inclusion in the Strategic Risk Register.

• Risks have already been recorded above KIM team level on the Business Services Department risk log. These include risks around the disposal of records, the performance of Vault and the way staff use it, as well as DFID’s ability to ensure compliance with policy. DFID has identified a range of potential legal and efficiency related effects. It now needs to build on this positive start, reviewing risk descriptions as the Office 365 environment is rolled out and adopted. See next steps

• After considering whether to expand the remit of the Information Security Management Group (ISMG), DFID now plans to create a separate Steering Group focussed on the management and exploitation of knowledge and information. This body will have a wider membership including the Chair of the re-scoped ISMG. See next steps

• The KIM team continues to explore how best to support and encourage good information and records management out in the business. It is looking at where local Vault champions are emerging and is reviewing the methods used by the existing Digital Ninja network to enable digital working. See next steps

• DFID has developed a new What to Keep Retention and Disposal Desk Guide and is developing specific schedules for business units based on short- medium- and long-term preservation requirements. Records management policy aspects of the Blue Book have also been updated and these are now being incorporated into the new DFID wide Corporate Control and Assurance Rules. However, DFID still needs to address the recommendation made in Sir Alex Allan’s 2014 report on publication of retention schedules.(^2) See next steps

- It is now mandatory for new starters to complete the Responsible for Information (RFI) training and DFID will measure this via the quality assurance regime it is developing (see below).

- Although Vault training is optional, DFID is working to promote the benefits of using the system effectively and has developed a variety of training/support options. These include classroom based training, self service guidance material and a centralised support desk, which it reports have been well received. DFID has also worked to increase coverage of information management responsibilities in induction packs.

- The KIM team will deliver and manage DFID’s new quality assurance regime. The aim of this is to check performance and advise departments of their information management responsibilities, based on a review of Vault file structures and security models, RFI compliance and spot checks on sensitive information. A pilot has been carried out with a business area. DFID aims to include an element of the quality assurance process in the Annual Director’s Assurance Statement. See next steps

- The KIM team is currently using Vault reports and a Management Information dashboard to monitor usage of the EDRM system and compliance with policy. DFID plans to incorporate this into the quality assurance process. See next steps

4 Records, review and transfer

| Performance rating | IMA 2015 | Review 2018 | |-------------------------------------|------------|-------------| | Oversight of records and selection | Satisfactory | Satisfactory | | Implementing disposal decisions | Satisfactory | Satisfactory |

- DFID has maintained progress with paper review. It is planning ahead to ensure that it continues to keep pace with the transition to the 20-year rule. It is exploring macro methods of appraisal such as using the digital registry system to do an initial sift. See next steps

- DFID has explored the option of using third-party contractors to ease pressure on staff resource, but has instead identified limited resource to continue this work in-house for the time being. See next steps

(^2) [https://www.gov.uk/government/publications/records-review-by-sir-alex-allan](https://www.gov.uk/government/publications/records-review-by-sir-alex-allan) • Content migrated from DFID’s old EDRM system, Quest, now has retention applied to it and a plan to action this for information of no continuing business use once migration is complete. DFID has also started to develop procedures using established retention criteria to review, dispose and transfer records of historical value to The National Archives. See next steps

• As of yet DFID has not established a process for sensitivity review of digital information. See next steps

Next Steps

The National Archives will continue to support DFID in its work on information and records management through to the time of its next IMA. In the interim, we recommend that DFID focusses on the following points and builds them into departmental business planning:

• Reporting on progress on implementing IMA action plan and delivery of the information strategy to the audit and risk committee.

• Identify a formal end point for the current strategy and ensure the new version embedded as a key component of wider corporate strategy.

• Working to embed the role of senior champion and to establish a network of senior champions that will support achievement of the information strategy goal: We manage our information in DFID. This would be a key enabler for overcoming the current behavioural, business process and skills barriers to good practice the strategy identifies.

• Continuing to promote good practice principles for information and records management including the effective use of IT systems.

• Continuing to move forward with work to improve approach to information asset management including Information Asset Registers.

• Continuing to factor information and records management considerations into the Office 365 rollout and into IT projects etc. as business as usual.

• Ensuring that any information of business or historical value held in locations outside Vault such as team sites or shared drives is migrated to Vault as required.

• Continuing work to ensure that information and records management risks are recognised and managed at a corporate level. Risk descriptions should reflect potential behavioural and cultural barriers to compliance as well as governance related causes. Risk descriptions need to reflect the changing picture of risk that will result from the adoption of Office 365. There may be benefit in learning from good practice approaches adopted by other departments within the IMA programme including the Ministry of Justice, HM Revenue & Customs, Home Office and Cabinet Office.

- As planned, establishing a governance group to cover information management and exploitation.
- Continuing to explore how best to support and encourage good information and records management out in the business via emerging Vault champions and other roles.
- Publicly publishing retention policy on GOV.UK as recommended by Sir Alex Allan.
- Including statistics on use of Vault, One Drive etc. in the quality assurance process and embedding the process as business as usual, extending this across the department.
- Continuing work to maintain progress with appraisal, selection, sensitivity review and transfer of paper records in order to keep place with the transition to the 20-year rule.
- Continuing to explore ways of streamlining the process of appraisal and selection of paper records and ensuring that this also feeds into processes for future digital appraisal and selection.
- Continuing work to develop a process for the appraisal, disposal and transfer of digital records from Vault. Including working with The National Archives on early testing of digital transfer.
- Seeking to develop a process for sensitivity review of digital records, drawing on work carried out by The National Archives and other government departments.
- Working with The National Archives on early testing of digital transfer from Vault.